Over 35,000 Grok-Built Apps Exposed Online, Some Leaking Confidential Data and Passwords

AI-assisted app builders have lowered the barrier to shipping software dramatically. A new research finding shows the same convenience can also lower the barrier to leaking secrets. According to security firm Claroc, more than 35,000 applications generated with Grok—the AI assistant developed by xAI—are reachable on the open internet without any authentication, and a subset of them are exposing confidential business information and credentials.

What Claroc Found

Claroc's researchers identified 37,571 Grok-built apps deployed online. Of those, 35,578 could be accessed by anyone without a sign-in, meaning the overwhelming majority lacked even basic access controls. The finding was reported on November 10, 2026, and covered by The Hacker News.

The exposed applications were not confined to hobbyists. The dataset included 24 apps built by employees at X, the social network owned by Elon Musk, and at SpaceXSI, the organization behind the Grok assistant. That detail matters: internal tooling built by staff at the companies closest to the platform was among the publicly reachable set.

Most of the open apps were low-stakes by design—games, landing pages, and calculators generated quickly and deployed without hardening. But roughly one in ten contained internal business data or other sensitive material, according to the researchers. Some apps were found leaking confidential information and passwords.

Why AI-Generated Apps Leak

The pattern is familiar to anyone who has watched the low-code and no-code wave. When a tool makes it trivial to produce a working application, deployment often happens before security review. Grok's app-building capability compresses the distance between a prompt and a live URL, and the default path tends to favor speed over access control.

Several factors compound the problem:

  • Defaults favor openness. Apps spun up quickly frequently ship without authentication enabled, because adding a login flow requires extra configuration that the builder may not prompt for.
  • Secrets end up in the frontend. AI-generated code can embed API keys, database connection strings, or credentials directly in client-side code, where anyone can read them.
  • No inventory. Organizations rarely track apps created by individual employees through an AI assistant, so these deployments never enter asset registers or vulnerability management programs.
  • Shadow IT at machine speed. A single employee can now produce dozens of apps in an afternoon, far outpacing any manual review process.

The Shadow AI Problem

The Claroc findings sit at the intersection of two trends security teams are already struggling with: shadow IT and shadow AI. Employees adopting generative tools without central approval is well documented. What is newer is that those tools now produce deployable artifacts—not just text or images, but running web applications that hold data.

An exposed calculator is harmless. An exposed internal dashboard, a customer lookup tool, or an app with a hardcoded database credential is a different matter entirely. The one-in-ten figure for sensitive content suggests that a meaningful number of these deployments cross that line.

The involvement of X and SpaceXSI staff apps underscores that this is not purely an issue for small teams or inexperienced users. Even technically sophisticated organizations can end up with unauthenticated endpoints when app creation is decentralized and deployment is frictionless.

What Security Teams Should Do

Discovery is the first step. Organizations should assume that employees are building and deploying AI-generated applications and should work to inventory them. Practical measures include:

  1. Scan for exposed assets. Use attack surface management tooling and internet-wide scanning data to identify applications tied to your brand, domains, and cloud accounts.
  2. Check for embedded secrets. Treat any AI-generated frontend as potentially containing credentials, and rotate keys found in client-side code.
  3. Establish guardrails. Publish clear policy on which AI builders are approved, what authentication is mandatory before deployment, and how apps get reviewed.
  4. Require authentication by default. Where possible, configure platform-level controls so new deployments are private unless explicitly published.
  5. Educate builders. A short briefing on secret management and access control catches many of these issues before they reach production.

The Broader Lesson

The Grok findings are unlikely to be the last of their kind. Every major AI platform is racing to offer app generation, and each one will produce a similar long tail of hastily deployed, unauthenticated software. The vulnerability is not in the model itself but in the workflow it enables: prompt, generate, deploy, forget.

For defenders, the takeaway is that the perimeter has expanded into places no one is watching—individual employee accounts on AI platforms, each capable of publishing a live application. Asset discovery, secret hygiene, and default-deny deployment policies are the controls that matter most. Organizations that treat AI app builders as a governed capability rather than an unmonitored convenience will avoid the exposure that Claroc documented at scale.

Source